Helm Chart Rules

MANDATORY: helm template --set test ALL changes with multiple value combos

Structure & Naming

• •Lowercase + hyphens: my-app
• •Standard: Chart.yaml, values.yaml, templates/, charts/
• •Clear nested names: database.timeout not db.ct

Values

• •No hardcoding: ports, replicas, images, timeouts, any varying string
• •Replace ALL instances: Find+replace entire chart
• •Defaults in values.yaml ONLY: {{ .Values.x }} not {{ .Values.x | default y }}
• •Environment-agnostic: Design for dev/staging/prod
• •values.yaml: no quotes on primitives (port: 8080, enabled: true)

Templates

• •2-space indent, NO excess quotes
• •Quote only when numeric/boolean must be string: port: "{{ .Values.port }}" (number→string) | name: {{ .Values.name }} (string, no quotes)
• •Whitespace: Use {{- to trim left and -}} to trim right
• •Conditionals: {{- if .Values.x }} or {{- with .Values.x }} (use with when referencing values inside)
• •Loops: range
• •NOTES.txt: Only for {{ required "msg" .Values.x }} validation, no other content

Resources

• •CPU: requests only (no limits)
• •Memory: requests == limits
• •Set resources appropriate for workload

Labels

• •Consistent selectors: Svc/Deploy/StatefulSet/NetworkPolicy must match
• •Use helpers: {{- define "chart.selectorLabels" -}}

Security

Required:

• •securityContext.runAsNonRoot: true (all containers)
• •readinessProbe (all deployments/statefulsets)
• •Secrets for sensitive data (never ConfigMaps)

Recommended:

• •livenessProbe with delays
• •Network policies
• •securityContext.readOnlyRootFilesystem: true where possible

Testing (MANDATORY)

E2E validation: Before ANY change, establish baseline with full chart test, then test each modification angle

Test with helm template --set:

• •Defaults (no overrides)
• •Changed values
• •Edge cases
• •Null/empty: value=null, value=[], value=""
• •Types: strings, numbers, booleans, arrays, objects
• •Interactions: modified value + other features
• •Conflicts: nodeSelector + tolerations, ingress + service types
• •Resources referencing changed value
• •Cross-template: ALL templates using changed value
• •Valid YAML: pipe to yamllint or yq
• •Example: helm template --set tolerations[0].key=x --set tolerations[0].value=y --set tolerations=null
• •helm lint before packaging

Dependencies

• •Pin subchart versions in Chart.yaml, override via chart name key
• •On changes: bump Chart.yaml version, update appVersion if app changes, revise description if functionality changes
• •Review subchart: helm show values <chart> to check defaults, structure, what's templated vs hardcoded; explicitly set critical values to avoid upstream changes

Anti-patterns

• •❌ Hardcoded values
• •❌ latest tags in prod
• •❌ No resource limits
• •❌ Inconsistent naming
• •❌ Secrets in ConfigMaps
• •❌ kubectl apply for testing (Always use helm template)